Delete job issue

SergeySH · ‎08-17-2020

Hello!

I faced with issue when I'm trying to delete old events using command " | delete". I find all events that I need in date range and then enter | delete command. After that scan is started and never ended. In job inspector I see component "dispatch.fetch.rcp.phase_0" with increasing Invocations and duration values. What could cause this issue? Why the delete job was not finished? Splunk Enterprise Server 7.2.5.1, two indexes in cluster, two search head in cluster.

FrankVl · ‎08-17-2020

Can you perhaps add a screenshot of how you are doing the |delete command?

SergeySH · ‎08-17-2020

@FrankVl

sure:
delete command.png

Delete job issue

Windows

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF

At .conf26, Don’t Just See What’s Next. Help Shape It at Innovation Labs.

Data Management Digest – August 2026

Join the Conversation

Delete job issue

Windows

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF

At .conf26, Don’t Just See What’s Next. Help Shape It at Innovation Labs.

Data Management Digest – August 2026